skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-lateral-movement-detection

Detects lateral movement techniques using SIEM correlation of Windows event logs and network telemetry.

954|172|Updated Mar 13, 2026
Search Tags:#threat detection#lateral movement#pass-the-hash#siem#splunk#psexec#mitre att&ck
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-lateral-movement-detection
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-lateral-movement-detection
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/soc-operations/performing-lateral-movement-detection
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-lateral-movement-detection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

SOC teams struggle to spot attackers pivoting between internal systems after initial compromise, since techniques like Pass-the-Hash, PsExec, WMI execution, and RDP pivoting blend into normal administrative traffic. This Skill provides ready-to-use Splunk detection queries mapped to MITRE ATT&CK Lateral Movement (TA0008) so analysts can identify and trace attacker movement paths.

Core Features & Use Cases

  • Credential Theft Detection: Identify Pass-the-Hash, Overpass-the-Hash, and Golden/Silver Ticket abuse via Windows Event Codes 4624 and 4769.
  • Remote Execution Detection: Catch PsExec service creation, WMI remote execution, WinRM/PowerShell remoting, and RDP pivoting using Sysmon and Security event logs.
  • Movement Path Reconstruction: Build source-to-destination lateral movement graphs correlating authentication events with network flow data.
  • Use Case: During an incident investigation, run the provided SPL queries to discover that a compromised account used NTLM authentication to reach five hosts, then trace the full pivot chain from workstation to domain controller.

Quick Start

Ask the AI to generate a Splunk detection query for Pass-the-Hash activity using Windows Security Event Code 4624 with NTLM authentication across multiple target hosts.

Frequently Asked Questions about performing-lateral-movement-detection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect Pass-the-Hash attacks with Splunk?▼

Detect Pass-the-Hash by querying Windows Security Event Code 4624 with Logon_Type 3 and NTLM authentication, then aggregating by source IP and counting distinct target hosts. A single account authenticating via NTLM to more than three hosts indicates possible hash reuse.

How to detect PsExec lateral movement in Windows event logs?▼

Detect PsExec through three telemetry sources: Sysmon EventCode 1 for psexec.exe or psexesvc.exe process creation, Sysmon EventCode 17 for PSEXESVC named pipes, and System EventCode 7045 for PSEXESVC service installation on target hosts.

What logs are needed for lateral movement detection?▼

You need Windows Security Event Logs (4624, 4625, 4648, 4672), Sysmon with process creation, network connection, and named pipe logging, plus network flow data from NetFlow or Zeek. A SIEM with cross-source correlation is required to combine these sources.

Can this detect lateral movement without Sysmon deployed?▼

Partial detection is possible using only Windows Security events like 4624 logon types and 5140 admin share access, but PsExec and WMI process-level detection requires Sysmon EventCode 1. Deploy Sysmon for full coverage of remote execution techniques.

Why does RDP lateral movement detection generate false positives?▼

Logon_Type 10 events fire for legitimate administrator RDP sessions, so thresholds matter. Filter by counting distinct destinations per source account and alert only when a user RDPs to more than two hosts, which distinguishes pivoting from routine administration.

When should I not use lateral movement detection queries?▼

Do not use these queries for detecting initial access or external attacks, since they focus exclusively on internal host-to-host pivot activity. They also require an established baseline of normal authentication patterns to avoid excessive noise.

Related Skills

Explore More Software Engineering Skills→
OpenTideHQOpenTideHQ
4

windows-event-logs

Document Windows-native telemetry sources and audit policy prerequisites for detection engineering.

Official
Advanced
UnitOneAIUnitOneAI
44

containment

Generate NIST SP 800-61 Rev 2-aligned containment plans with MITRE ATT&CK-mapped countermeasures.

Official
Intermediate
woohyun212woohyun212
21

ad-pentest

Perform six-phase Active Directory penetration testing with BloodHound and ADCS enumeration.

Community
Advanced
briiirussellbriiirussell
345

threat-hunting

Conduct hypothesis-driven threat hunts in SIEM/EDR logs using PEAK workflows.

Community
Advanced